English translation is being prepared.
Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary

Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary、Body
Matched fieldsSummary
Matched fieldsSummary
Cato AI Labs discovered two remote code execution vulnerabilities in Cursor IDE that can lead to sandbox escape, both with a CVSS score of 9.8, tracked as CVE-2026-50548 and CVE-2026-50549. The two vulnerabilities stem respectively from the working_directory parameter of run_terminal_cmd being blindly added to the sandbox writable list, and from the fallback logic when symlink canonicalization fails; attackers can overwrite the cursorsandbox binary through zero-click prompt injection in an MCP server or web search results, achieving non-sandboxed RCE. The Cursor team fixed both issues in Cursor 3.0, released on April 2.
Cato AI Labs discovered two remote code execution vulnerabilities in Cursor IDE that can lead to sandbox escape, both with a CVSS score of 9.8, tracked as CVE-2026-50548 and CVE-2026-50549. The two vulnerabilities stem respectively from the working directory parameter of run terminal cmd being blindly added to the sandbox writable list, and from the fallback logic when symlink canonicalization fails; attackers can overwrite the cursorsandbox binary through zero-click prompt injection in an MCP s
Matched fieldsSummary、Body

Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary
Matched fieldsSummary

Matched fieldsSummary

Matched fieldsSummary

Matched fieldsSummary